Passive DNS - Common Output Format ================================== This document describes the output format used between Passive DNS query interface. The output format description includes also a common meaning per Passive DNS system. This format originated as a discussion between Aaron Kaplan, Paul Vixie, Henry Stern and Alexandre (Adulau) in ~ 2011. It was submitted to the IETF in 2014 and since then had a few minor updates. It is being used by multiple operators of passive DNS services to offer an identical output format for queries to a passive DNS database. This allows the person issuing the query to combined and/or compare results. The output format is in JSON. How to Contribute to the Document --------------------------------- You can make pull request to the xml document. We are looking for comments from passive DNS developers in order to improve the document. IETF Internet-Draft ------------------- - [Version 7 published as Internet-Draft](https://datatracker.ietf.org/doc/draft-dulaunoy-dnsop-passive-dns-cof/) - June 25, 2020 Users and Use-cases -------------------- * [CERT.at](https://pdns.cert.at) * [Farsight](https://farsightsecurity.com) * [CIRCL](https://www.circl.lu/services/passive-dns/) * [D4 Project Passive DNS](https://www.d4-project.org/2019/05/28/passive-dns-tutorial.html) * [balboa](https://github.com/DCSO/balboa) * ... add yours please. Create a pull request to this file please.